github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tpm: tpm_nsc: fix NULL pointer dereference on init failure

Browse Source 
tpm_nsc_remove() is used as the release callback of the hand-created
platform device and dereferences the chip drvdata unconditionally.
If init fails before tpmm_chip_alloc() (e.g. request_region() cannot
claim the ports), the error path drops the last device reference and
the release callback runs with chip == NULL, crashing module init.

Return early when the chip has not been created yet.

Cc: stable@vger.kernel.org
Fixes: afb5abc262 ("tpm: two-phase chip management functions")
Assisted-by: GLM-5.3
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/d5f0b38d6d6c17c01519c879d26448dbae388b0e.1791015549.git.xiaopei01@kylinos.cn
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Pei Xiao 2026-10-03 16:27:52 +08:00 committed by Jarkko Sakkinen
parent 7d4f1cbfe0
commit 1900449684
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/char/tpm/tpm_nsc.c
View File

@ -259,7 +259,12 @@ static struct platform_device *pdev = NULL;
static void tpm_nsc_remove(struct device *dev)
{
struct tpm_chip *chip = dev_get_drvdata(dev);
struct tpm_nsc_priv *priv = dev_get_drvdata(&chip->dev);
struct tpm_nsc_priv *priv;
if (!chip)
return;
priv = dev_get_drvdata(&chip->dev);
tpm_chip_unregister(chip);
release_region(priv->base, 2);